Runtime Governance for Agentic AI: Action-Boundary Control with Trusted Provenance and Fail-Closed Execution
06:00 · August 19, 2026 · arXiv cs.AI RSS
Agentic AI systems request tool actions that can modify files, send messages, launch jobs, or change workflow state. This shifts the safety problem from harmful text generation to harmful operational side effects. Prompt-level governance can shape model behavior, but it does not create an execution boundary. We introduce Aegis, a runtime governance system that treats model outputs as action proposals and mediates them through a trusted decision layer before tool execution. The model proposes; the trusted runtime decides. Aegis evaluates proposals against active policy state, resolves provenance server-side, fails closed under uncertainty, and routes selected cases through Senate-style settlement, a quorum- based non-unilateral authorization path. We evaluate Aegis on a repeated sandbox corpus spanning five run families, 42 tasks, three conditions, and ten repeats per family. Across 6,300 rows, prompt-policy conditioning produced 79 risky comparator-path leakage rows. Across 2,100 Aegis-governed rows, the system recorded zero governed mock-tool applications and zero governed risky side-effect completions. All 1,832 Aegis-attempted governed rows preserved trusted Aegis-resolved provenance, and all 1,019 Senate-settled rows had quorum and final signed tally evidence. These results do not prove general autonomous-agent safety. They support the narrower systems claim that, in this evaluated sandbox corpus, runtime action-boundary governance prevented observed risky proposals from becoming governed side effects.
Summary
Agentic AI systems move beyond text generation by requesting tool actions that can alter files, transmit messages, launch jobs, or modify workflow state. This change relocates the primary safety concern from harmful output to harmful operational side effects. Prompt-level instructions can influence model behavior yet remain internal to the system being governed and offer no external execution boundary that can reliably block unauthorized actions.
Aegis addresses this gap by inserting a trusted runtime layer between model output and tool invocation. The model produces action proposals only; the runtime evaluates each proposal against active policy state, resolves provenance on the server, and withholds execution when requirements are unmet. Under uncertainty the system fails closed. Selected cases requiring broader review are routed through Senate-style settlement, a quorum-based authorization path that prevents unilateral decisions.
In repeated sandbox trials covering 42 tasks across five run families and three conditions, prompt-policy conditioning still allowed 79 risky leakage events across 6,300 rows. The Aegis-governed path recorded zero governed mock-tool applications and zero governed risky side-effect completions across 2,100 rows. All governed attempts preserved server-resolved provenance, and all Senate-settled cases carried quorum and signed-tally evidence.
The authors present these results as a narrow systems claim rather than a general guarantee of autonomous-agent safety. They show that, within the evaluated corpus, moving governance from model instructions to a runtime action boundary prevented observed risky proposals from producing side effects while maintaining auditable decision traces.
Why it matters
This research is highly relevant for Dutch AI practitioners and researchers focusing on trustworthy AI and EU AI Act compliance. It provides a concrete, actionable architecture for securing autonomous agents against operational risks, which is critical for enterprise deployment in the Netherlands.
